Changelog

• 6a62356 feat: add named-config option (#3)
  • Adds -C, --named-config to load a profile from the sandboxec/profiles repository (resolved to raw YAML on the based branch).
  • Enables running with shared profiles without a local config file, e.g. sandboxec --named-config agents/claude -- claude.
  • --config and --named-config are mutually exclusive; using both now returns an explicit error.
  • Named values are normalized (/prefix and .yaml/.yml suffixes are handled); empty values fail fast.

Verify

First, verify the file using checksums.

sha256sum --check --ignore-missing sandboxec_v0.3.0-checksums.txt

Then, ensure the authenticity of the release asset with Sigsum:

go install sigsum.org/sigsum-go/cmd/sigsum-verify@v0.13.1

sigsum-verify -k sandboxec-sigsum-key.pub -p sigsum-trust-policy.txt \
  sandboxec_v0.3.0-OS_ARCH.proof < sandboxec_v0.3.0-OS_ARCH

Changelog

• abdb7b8 bump github.com/modelcontextprotocol/go-sdk@v1.4.0

Verify

First, verify the file using checksums.

sha256sum --check --ignore-missing sandboxec_v0.2.2-checksums.txt

Then, ensure the authenticity of the release asset with Sigsum:

go install sigsum.org/sigsum-go/cmd/sigsum-verify@v0.13.1

sigsum-verify -k sandboxec-sigsum-key.pub -p sigsum-trust-policy.txt \
  sandboxec_v0.2.2-OS_ARCH.proof < sandboxec_v0.2.2-OS_ARCH

Full Changelog: v0.2.1...v0.2.2

Changelog

• c567a24 feat: add unsafe-host-runtime support (#1)
  • Improves out-of-the-box compatibility for host-linked tooling: use --unsafe-host-runtime flag (or unsafe-host-runtime: true in YAML) when sandboxed commands fail due to runtime/library access.
  • Opt-in ONLY when needed; it broadens read_exec access to runtime paths and discovered shared-library dependencies, so it should be treated as a trusted-workload opt-in.
  • May increase startup latency: dependency discovery is done before launch, which is more noticeable for short-lived commands.

Verify

First, verify the file using checksums.

sha256sum --check --ignore-missing sandboxec_v0.2.1-checksums.txt

Then, ensure the authenticity of the release asset with Sigsum:

go install sigsum.org/sigsum-go/cmd/sigsum-verify@v0.13.1

sigsum-verify -k sandboxec-sigsum-key.pub -p sigsum-trust-policy.txt \
  sandboxec_v0.2.1-OS_ARCH.proof < sandboxec_v0.2.1-OS_ARCH

Changelog

• dd71525 init 1

Verify

First, verify the file using checksums.

sha256sum --check --ignore-missing sandboxec_v0.1.0-checksums.txt

Then, ensure the authenticity of the release asset with Sigsum:

go install sigsum.org/sigsum-go/cmd/sigsum-verify@v0.13.1

sigsum-verify -k sandboxec-sigsum-key.pub -p sigsum-trust-policy.txt \
  sandboxec_v0.1.0-OS_ARCH.proof < sandboxec_v0.1.0-OS_ARCH